Splunk Search

How to search the total distinct count on two different fields?

jameskerivan
Explorer

Hi,

This is kind of a silly question, but currently my application is logging the session id as two separate fields, Session_id and sessionId. Now sometimes either of the session ids can be NA. I want to find the total unique session id's for my search based on those 2 fields. An example would be like

session_id = 2 sessionId = 2
session_id = NA sessionId = 3
session_id=1 sessionId = NA

So my count would be 4 with counts for {2, NA, 3, 1}

Thanks so much!

0 Karma

chanmi2
Path Finder

Try this:

your search | eval combine_session = session_id.",".sessionID | makemv delim = "," combine_session | stats dc(combine_session), values(combine_session)
0 Karma

justinatpnnl
Communicator

Normally you would use the COALESCE function for this, but if the session_id literally has the string "NA" then that poses a problem.

I would probably attack it like this:

<your search here>
| eval new_session_id  = case(isnum(session_id), session_id, isnum(sessionID), sessionID, 1==1, "NA")
| stats dc(new_session_id)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...